CodeQL 2.27.2 parses std::regex, rebuilds Go's CFG and drops traced builds on macOS 27
Serguey Asael Shinder2 min readGitHub shipped CodeQL 2.27.2 on 9 October. For most code-scanning users it arrives automatically on github.com; two parts of it need a decision from whoever maintains a pipeline or a custom query pack.
Coverage additions. CodeQL now parses regular expressions written in the ECMAScript grammar of C++ std::regex, so its regex checks can now look inside C++ patterns. On the C side it adds SQL-injection sink models for the Comdb2 C API and flow summaries for Bloomberg BDE codecs and byte-stream deserializers. Go gains models for the github.com/coder/websocket import path alongside the older nhooyr.io/websocket. The Rust extractor learns AnyAttr and DocComment, data flow through async blocks used with await improves, and there are flow summaries for native-tls, async-native-tls and tokio-native-tls. In JavaScript, the Workflow SDK's use workflow and use step directives are recognised, and Hapi route handlers registered through custom helpers are tracked. For C#, the clickjacking query accepts ASP.NET Core headers and CSP frame-ancestors, and the XSS query stops flagging Razor tag-helper values written with WriteLiteral. GitHub puts the default suite at 498 security queries over 170 CWEs; the extended suite adds 131 queries and 32 CWEs.
Decision one: custom Go queries. The Go control-flow graph now uses CodeQL's shared CFG library. The changelog lists the consequences plainly: new nodes for assignments, parameters, results, range statements and deferred calls; unreachable nodes removed; and changed nodes, edges, locations, text and basic-block boundaries. BasicBlocks::Cfg is removed, IfStmt.getCond is deprecated in favour of getCondition, and IfStmt.getThen and LoopStmt.getBody now return Stmt. Teams with their own Go queries that walk the CFG should run their tests against 2.27.2 before relying on the results — the standard suites are maintained by GitHub, your pack is not.
Decision two: macOS runners. Apple stopped shipping multi-architecture x86-64/arm64 binaries with macOS 27 and Xcode 27, and CodeQL's traced analysis depends on them. As a result, autobuild and manual build modes are unsupported for compiled languages on macOS 27 with any Xcode, and on macOS 26 when Xcode 27 is selected. GitHub's advice is to stay on macOS 26 with Xcode 26 for those modes; it says it is working on build-mode: none for macOS as a mitigation. A workflow that pins macos-latest should be checked for what that label resolves to.
Smaller CLI changes: the actions/unpinned-tag query can now drop owners from its trusted list with a ! prefix (for example !github), invalid qlpack: and from: values in suites produce errors instead of crashes, out-of-range integers in YAML data extensions are rejected rather than truncated, and messages on standard error now start with ERROR: or WARNING: — logs and SARIF are unchanged.
GitHub Enterprise Server will get 2.27.2 in a future release; older GHES installations can upgrade CodeQL manually.
Source: GitHub Changelog, CodeQL 2.27.2 improves C++, Go, Rust, and JavaScript analysis, 9 October 2026 — https://github.blog/changelog/2026-10-09-codeql-2-27-2-improves-c-go-rust-and-javascript-analysis